Highlights
✨ Filter parse-live by syscall, subsystem or event
developer dvt core-profile-session parse-live can now show only what you ask for, and keeps up with the device while it does:
--syscall/-sselects BSD syscalls by name, for example-s open -s openat. The output still includes the paths they open.--fs,--netand--procselect groups of syscalls: those that take a path, socket syscalls, and process-lifecycle syscalls.--dyldshows dyld events (dlopen,dlsym, image maps) with their paths and symbol names.--event/-eselects any trace event by name.
The syscalls [--group fs|net|proc] and events commands list the names these options accept. A misspelled name is rejected before a device is chosen.
pymobiledevice3 developer dvt core-profile-session parse-live -s open -s openat
pymobiledevice3 developer dvt core-profile-session parse-live --fs --dyld
pymobiledevice3 developer dvt core-profile-session parse-live -e DBG_DYLD_TIMING_DLOPEN
pymobiledevice3 developer dvt core-profile-session events | grep -i dyld📦 pykdebugparser 1.4.0
- iOS 27.2 trace codes: the event table now matches iOS 27.2.
- More parsed syscalls: AIO,
wait4,sigwait,mknodat,ledger,openat_dprotected_np, and the iOS 27 additionspipe2,dup3,fchflagsatandgetumask, among others. - Events without a parser: events requested with
--syscall/--eventthat have no parser are printed with their raw values instead of being dropped.
What's Changed
- 4eec03c core_profile_session: Require pykdebugparser 1.4.0 (#2045) (@doronz88)
- 13de0aa core_profile_session: Filter parse-live by syscall, subsystem and event (#2044) (@doronz88)
Full Changelog: v11.34.1...v11.35.0